Networking and Network Virtualization (Flow, VLANs, Overlay)
Networking questions mix AHV plumbing (bridges, bonds, VLANs) with the two Flow products: Flow Network Security for microsegmentation and Flow Virtual Networking for overlay networks.
AHV underlay
- OVS runs on every host; br0 is the default bridge, and VLAN-backed networks appear as br0. sub-interfaces.
- Bond modes: active-backup (no switch configuration, single active link), balance-slb (per-flow hashing, no switch configuration, tolerates mismatched switch settings), balance-tcp (requires an 802.3ad LACP port-channel). Only balance-tcp needs LACP.
- Managed networks receive IPAM addresses from AHV; unmanaged networks depend on external DHCP.
Flow Network Security
- Policies are written against categories (for example AppType=PCI, Environment=Prod) rather than IP addresses, so they survive VM moves and re-addressing.
- Policy types include Isolation (deny all except listed flows), Quarantine (block a VM during incident response) and Application (allow specific service flows).
- Run in Monitor mode first, review the observed flows, then Enforce.
Flow Virtual Networking
- Builds overlay networks on top of the physical underlay with integrated routing and NAT, so tenant networks do not require VLANs stretched across racks.
Worked example
Three PCI VMs must reach only a database VM. Assign category AppType=PCI to the three VMs; create an Application policy allowing TCP 1433 to AppType=DB; add an Isolation policy for AppType=PCI; monitor for a week, then enforce. Reasoning: the Application policy is allow-only for listed flows, and Isolation makes the default-deny explicit and auditable.
Traps
- Expecting microsegmentation to police traffic to physical hosts or the internet - it covers VM-to-VM flows on AHV.
- Enforcing before monitoring, which cuts off management or backup traffic.
- Configuring balance-tcp without LACP, which degrades silently to one active link.